WO2004068783A1

WO2004068783A1 - Device and method for the calculation of encoded data from uncoded data or uncoded data from encoded data

Info

Publication number: WO2004068783A1
Application number: PCT/EP2004/000813
Authority: WO
Inventors: Manfred Aigner; Holger Bock
Original assignee: Infineon Technologies Ag
Priority date: 2003-01-30
Filing date: 2004-01-29
Publication date: 2004-08-12
Also published as: US20060020822A1; EP1588518A1; EP1588518B1; DE10303723B4; DE10303723A1; DE502004003397D1

Abstract

The invention relates to a device and method for the calculation of encoded data from clear text data or clear text data from encoded data, in which a cryptographic algorithm is employed, comprising an initial stage (10), an intermediate stage (11), a terminal stage (12) and an intermediate stage preceding the terminal stage, whereby the processor device (13), for carrying out the cryptographic algorithm, is embodied such that either the initial stage (10), or the terminal stage (12), or both the initial stage (10) and the terminal stage (12) are carried out in a manner secure against a cryptographic attack, whilst the intermediate stage is carried out in a manner not secure against cryptographic attack. An energy saving, and optionally also a time saving and a chip surface area saving relative to a completely secure calculation of the cryptographic algorithm can thus be achieved with the same security level against cryptographic attack, for example, a DPA attack.

Description

description

Device and method for calculating encrypted data from unencrypted data or unencrypted data from encrypted data

The present invention relates to cryptography concepts and in particular to the protection of cryptography concepts against attacks against the same.

3a shows an example of a representation of the known DES algorithm, which is described, for example, in chapter 7.4.2 of the textbook “Handbook of Applied Cryptography, Menezes u. a., CRC Press, 1996. The DES is a Feistel encryption algorithm, the plain text blocks with n = 64

Bits processed to produce blocks of 64-bit encrypted data and vice versa. The effective size of the secret key K is k = 56 bits. In particular, the input key is specified as a 64-bit key, whereby 8 bits can be used as parity bits. The 2 ⁵⁶ keys implement 2 ^{56 of} the 2 ⁶⁴ possible bijections in 64-bit blocks.

Referring to Fig. 3a, the input data is entered at block 30 and initially an initial permutation

(IP; IP = Initial Permutation) 31 subjected. Then the bits of this so-called zero round are divided into a left block Lo and a right block Rn, as shown at 32 in Fig. 3a. This data is then processed in a first round of the DES algorithm, namely under

Use of a round function 33, which generates output data from a first round key Ki and the right data block R ₀ , which are linked to the left data using an XOR link 34 in order to generate new right data Ri. The new left data Li correspond to the old right data Rn. In FIG. 3a, the first round, that is to say the processing using the first round key Ki, is designated as the initial stage 1. In an initial stage 2 following the initial stage 1, the same procedure as shown in the block diagram of FIG. 3a is carried out, but now with the result of the XOR operation 34 as an input to the cryptographic function 33. In this second round or initial stage 2, however, a second round key K _{2 is} used in order to then link the output data of function 33 of initial stage 2 again with the old right data Rn (which is the new left data Li) by means of an XOR link 35. This procedure is carried out for intermediate stages or rounds 3 to 14 in succession. The DES algorithm has a total of 16 rounds. In the 15th round, which is denoted by output stage 1 in FIG. 3a, a 15th round key K _i5 (not shown in FIG. 3a) is used. In a last final stage of the DES algorithm, which is the 16th round and is also referred to in FIG. 3a as final stage 2, the cryptographic key is then used one last time using the 16th round key K ₁₆ and the corresponding input data R _i5. graphic function 33 performed to XOR the output data of the cryptographic function 33 of the 16th round with the left data block Ii _{15 of} the previous round, and then, as shown in FIG. 3a, the left and right Rearrange data (block 37).

The data arranged in the manner indicated in block 37 of FIG. 3a are then subjected to an end permutation which is inverse to the initial permutation 31 and is designated by 38 in FIG. 3a. The encrypted data is then present at the output of block 38, more precisely a block of encrypted data, as illustrated at 39. The entire procedure is carried out in reverse for decryption. 3b shows the internal function f (33 in FIG. 3a) of the DES algorithm. The right data Ri_ι of the preceding stage or the previous round are subjected to an expansion 40 and then subjected to an XOR operation 41 with the round key Ki, in order then to be arranged in eight groups of 6 bits each (42). A substitution operation is then performed using eight different predefined tables 43, which are also referred to in the art as SBOXES. Each of the SBOXES provides a 4-bit value at its output. The output data of the substitution operation 43 is then arranged in blocks (44) to undergo a permutation operation 45. The output data of the permutation 45 thus form the output data of the cryptographic function 33 from FIG. 3a, which is also referred to as a round function.

The DES algorithm is a so-called block cipher because it calculates a block of output data (39 in FIG. 3a) from a block of input data (30 in FIG. 3a). There are various types of block cipher, which are listed in Chapter 7 of the textbook cited above. In general, there is a block encryption algorithm with several stages, as indicated in FIG. 4. Such a multiple encryption algorithm receives the unencrypted data on the input side, which is also referred to as plain text P. They are subjected to an initial stage of an overall encryption algorithm, which is denoted by 46 in FIG. 4. In the initial stage, a first key Ki is used. The output data A of the initial stage are then fed to an intermediate stage 47 which carries out an alternative or the same encryption operation as the initial stage, but now with the key K ₂ , which typically differs from the key Ki. The output data B of the intermediate stage are then fed to a final stage 48 which carries out a further encryption operation, but now with another key K _{3 of} the final stage, which typically differs from the keys K _{x of} the initial stage 46 and the key K _{2 of} the intermediate stage 47 differentiates. The encrypted data block or ciphertext C results at the output of the output stage 48.

The DES algorithm described in FIGS. 3a and 3b is based on two general concepts, namely the product encryption algorithms and the Feistel encryption algorithms. Each principle involves iterating over a common sequence or round of operations. The basic idea of a product encryption algorithm is to build up a complex encryption functionality by putting together several simple operations which, when viewed together, are relatively more secure, but which, viewed individually, do not provide adequate protection. These basic operations include transpositions, translations (eg XOR) and linear transformations, arithmetic operations, modular multiplications and simple substitutions. A product encryption algorithm thus combines two or more transformations of different types in such a way that the resulting encryption is more secure than the individual components.

A Feistel encryption algorithm is an iterated encryption mapping of a 2 t-bit plain text (e.g. t-bit blocks L ₀ and R ₀ into an encryption text (R _r , L _r ), by a process with r rounds, whereby r is greater than or equal to 1. Typically a round number of r> 3 is preferred, with r often being an even number A typical feature of the Feistel structure is that the blocks of the left data and the right data from round to round be replaced.

Decryption is achieved by performing the same r-rounding process, but with subkeys that are used in the reverse order, ie K _r to Ki. The encryption function of the Feistel- Encryption algorithm can be a product encryption algorithm, whereby f itself does not have to be invertible in order to allow an inversion of the Feistel encryption algorithm.

From the above discussion of known encryption algorithms it is clear that modern encryption algorithms typically consist of a sequence of identical round functions (FIG. 3a) or generally of a cascading of the same or different encryption concepts, each of the algorithms under consideration having an initial stage, at least one intermediate stage and one final stage has, whereby in the processing of each of the above-mentioned stages, ie the initial stage, the intermediate stage or the final stage, a secret or part of this secret is typically processed, namely a key Ki, ..., K _n , which - for a symmetrical one Algorithm - the entity performing the encryption operation on the one hand and the entity performing the decryption operation on the other hand must be known.

One essence of cryptographic algorithms is that information is encrypted that is sensitive in some way, that is, should not be made accessible to third parties. This means that attacks against cryptographic algorithms are developed and carried out in order to still be able to access the sensitive information without knowing the key. Since the basic structure of the cryptographic algorithms described above is publicly known, the only component unknown to the attacker is the key itself and possibly the plain text, some attacks aim to find out the key in some way. As soon as an attacker has determined a key, he has "cracked" the cryptographic system. It should be pointed out here that the most valuable information for the attacker is the key itself. Nevertheless, attacks are also conceivable which only the plain text is cracked, but not the key itself. These attacks are, however, suboptimal, because without knowing the key, an effort must be made for each attack that does not occur if the key itself has been cracked.

Attacks against cryptographic systems, i.e. cryptographic attacks, are diverse in nature. The DPA attack described here is also referred to as an implementation attack as a special form of a cryptographic attack, since the attack is not aimed directly at the cryptographic system, but at an implementation of the system.

A particularly dangerous and in principle easy to carry out cryptographic attack was presented by P. Kocher, J. Jaffer and B. Jun. This cryptographic attack is referred to in technology as a DPA attack. DPA means Differential Power Analysis. In particular, the difference between two mean values of power measurements is analyzed in order to determine the secret key of a cryptographic calculation which is carried out by an electronic device. A DPA attack basically consists of two parts, namely many precise measurements of the power consumption of an electronic device during the execution of a known cryptographic algorithm, always using the same key (which is not known in advance, but is the target of the attack) and the data to be encrypted are varied. The second part of the DPA attack consists of a statistical calculation using the performance measurement data in order to ensure the correctness of an assumption, i. H. the key hypothesis, for a certain part of the key, such as B. 6 bits to verify.

A particular "advantage" of the DPA attack is that the circuit itself does not have to be manipulated in any way. All that is required is the power consumption of the Circuit measured somewhere outside the electronic device in an easily accessible location. In addition, no so-called reverse engineering has to be carried out. It does not matter where the calculations are carried out on the chip, especially when it is remembered that on a chip there is typically not only the crypto processor but also other components.

In addition, it does not matter when exactly the cryptographic calculations are carried out on the chip, since the performance can be measured in a time interval. In addition, it is not necessary for an attacker who carries out a DPA attack to understand the nature of the DPA attack. If he knows how to proceed and has the software for the statistical calculations, the attacker does not have to understand why the DPA attack works. Therefore, the DPA attack is basically a cheap and simple attack. An attacker only needs precise measuring equipment, since the DPA attack is basically based on the determination of a signal / noise ratio. In addition, the attacker must repeat the execution of a known algorithm. He must therefore be able to provoke the execution of the algorithm with the same key and different input data.

Since the DPA attack in particular, and in particular also other related cryptographic attacks, builds on the power consumption of the circuit that carries out a cryptographic algorithm, efforts to protect against DPA attacks are based on the fact that the power consumption of the

Circuit is homogenized. Ideally, such a circuit that is optimally protected against DPA attacks always shows the same power consumption behavior, regardless of the data to be encrypted, so that a DPA attacker can carry out his DPA attack calmly, but always receives the same performance profile for all different input data , In this case, if he always Before the performance profile has been measured, the statistical analysis will fail or will not produce any significant results, so that the DPA attack is doomed to fail.

Typical circuits are built using CMOS technology. Circuits built in CMOS technology consume only negligible power if no changes in state occur. Power consumption only occurs when a CMOS circuit changes from a state (for example a logic 1) to a complementary state (a logic 0) and vice versa. In addition, conventional CMOS circuits have the property that changes from 0 to 1 (0 corresponds, for example, to a voltage of 0 V or Vss, while “1” corresponds to a high voltage Vdd, for example) have a different power consumption than the change in state in The power profile of the circuit is thus different when changing from 1 to 0 than when changing from 0 to 1. In order to homogenize this power consumption, it is known to provide a dual-rail circuit 50, as shown in FIG 5 is shown.

In a dual-rail circuit, each logical function and each connecting line between logical functions is designed twice. One path (rail) processes the actual useful bit, while the other path processes in parallel the bit that is complementary to the useful bit. If there is a change from 1 to 0 on the first rail, a change from 0 to 1 takes place simultaneously on the other rail. The power consumption of this circuit results in a peak that is twice as high as in a single-rail version, but is now the same for every change on the useful path (and thus on the complementary path).

However, a problem with a dual-rail circuit is still that if a state in one cycle is the same as the state in the subsequent cycle, that is, if there is no change of state, there is also no peak in power consumption. occurs. An attacker can no longer distinguish whether there has been a change from 0 to 1 or from 1 to 0. However, he can very well see from the performance profile whether a change of state has taken place or not.

In order to close this gap, the dual-rail technology is supplemented by the pre-charge or pre-discharge technology. A so-called preparation clock Pr is switched between each useful clock cycle N, as is indicated by a clock generator 51 in FIG. 5. In the useful cycle, the dual-rail circuit carries out the usual calculation specified by a cryptographic algorithm. In the preparation cycle, however, both complementary lines, such as. B. x _lr NOT xi set to the same state. In the case of pre-charge, this state is the high voltage state. In the case of pre-discharge, this state is the low voltage state. Depending on the setting in which the dual-rail circuit 50 is embedded, the pre-batch or pre-batching can be carried out by means of a preparation device 52 shown schematically in FIG. 5 at the input of the dual-rail circuit (xi) or at the output of the dual-rail circuit yi or both at the input and at the output.

The use of the pre-charge technique has the advantage that, as shown in the table in FIG. 6, the number of cycles is always the same from one cycle to the next, ie from one pre-charge / pre-discharge cycle to one useful cycle of states changes, irrespective of which states the useful bits to be processed and the bits complementary to the useful bits have. Thus, in the case of precharge (all lines are on “1”), two states (NOT xi, x ₂ ) or in the case of pre change during the transition from state 60 of FIG. 6 to state 61 in a useful cycle of FIG. 6 -Discharge also two states. When changing from state 61 to a state 62, exactly two bits change again in the case of pre-charge and two bits in the case of pre-discharge. A change of two bits also takes place, when changing from state 62 to state 63 etc. The dual rail technology therefore has the decisive advantage that an attacker cannot distinguish between a change from 0 to 1 or 1 to 0 (due to the dual rail technology ), and that the attacker can also no longer see from the performance profile whether a change in status has occurred on a line or not.

Although the dual-rail technology with pre-charge / pre-discharge provides effective protection against DPA attacks, it is expensive to buy. The chip consumption of the dual rail circuit is twice as large compared to the case in which this circuit is carried out in single rail. In addition, the energy consumption of such a circuit in dual-rail technology is up to twice as high as in the case of dual-rail technology without precharge and even - due to the double design of the circuit - four times as high as a simple, unsafe single-rail -Circuit. In addition, the provision of pre-charge / pre-discharge clocks between the useful clocks means that the data throughput is half as high in relation to a number of clock cycles.

In summary, dual-rail technology with pre-charge / pre-discharge leads to a DPA-safe circuit implementation. However, this security is expensive, namely by up to twice the chip area consumption and up to four times the energy consumption compared to an unsecured circuit.

The object of the present invention is to create a secure, yet efficient cryptography concept.

This object is achieved by a device according to patent claim 1, a method according to patent claim 17 or a computer program according to patent claim 18. The present invention is based on the finding that, in the case of cryptographic algorithms which have an initial stage and a subsequent stage or an end stage and a preceding stage, it is sufficient to ward off cryptographic attacks only against the initial stage and / or the final stage secure cryptographic attacks. According to the invention, however, it is not necessary to secure the intermediate stage or the typically several intermediate stages from cryptographic attacks, as long as the stage downstream of the initial stage bases its calculations on the output data output by the initial stage.

Analogously to this, for a reverse attack which is also conceivable, that is to say an attack carried out on the basis of the encrypted data, it is sufficient to merely secure the final stage against the attack, but not the stage preceding the final stage, which will typically be an intermediate stage. In other words, in the case of such cascaded algorithms in which an intermediate stage is based on results from the preceding or subsequent stage, it is sufficient to secure only the first and / or the last stage against cryptographic attacks, while the intermediate stage or the plurality of intermediate stages merely be implemented with reduced security or no security at all, i.e. operated in an unsecured operating mode.

Of course, this enables attacks on the stages operated in an unsecured operating mode. However, these will be of no use, since no clear hypothesis can be established, since the input data to the unsecured level has already been encrypted using a secret key (or decrypted in the case of decryption). In figurative terms, the present invention is therefore based on the knowledge that it is sufficient to secure a forbidden aisle by simply locking the entrance and exit doors securely, but not in the aisle also existing intermediate doors, because an attacker does not, figuratively speaking, do so Intermediate door can get if the entrance and the exit door of the corridor are optimally secured.

As has been explained above, security against cryptographic attacks always goes hand in hand with significantly increased costs in chip area, energy consumption and possibly processing time. The inventive calculation of intermediate stages in an unsecured mode therefore leads directly to a saving in energy, possibly chip area and possibly time. However, if the initial stage and / or the final stage are optimally secured, ie if these stages are carried out in a manner that is secured against cryptographic attacks, then no security losses have to be accepted.

The present invention thus provides, on the one hand, a secure and, on the other hand, a more efficient concept for calculating encrypted output data from plain text input data or - in the case of decryption - a concept for calculating plain text input data from encrypted output data.

An advantage of the present invention is thus that the effort in terms of at least the current / energy requirement is reduced, while a successful defense against DPA attacks on cryptographic circuits is nevertheless ensured if, as is the case in a preferred exemplary embodiment, one Dual-rail pre-charge logic is used as a measure for securely carrying out the initial stage and / or the final stage of a cryptographic algorithm. In contrast to an application in which DPA attacks should be warded off by using a dual-rail precharge logic, for example for a DES module, in which the precharge process is carried out during the entire calculation of the DES algorithm What would lead to considerable additional energy consumption in relation to non-DPA-secured circuits with the same function, the additional energy consumption according to the invention is only accepted where it is also necessary, namely to carry out the initial stage and / or Power stage of the cryptographic algorithm in a secure manner.

Since the DPA is based on the fact that to check the assumption (hypothesis) via the “target bit”, a calculation of a part of the DES algorithm has to be carried out, an attack typically taking place in rounds 2 or 15 of the 16 DES rounds According to the invention, rounds 3 to 14 are not particularly protected if the attack on the round key of rounds 2 or 15 has already been successfully warded off, and it is recognized according to the invention that at least the precharge process is carried out in rounds 3 to 14 represents a waste of energy if it is ensured that the partial keys from rounds 1 and 2 (the initial stage) or 15 and 16 (the final stage) can be successfully "defended".

The present invention thus also consists in a flexible control for a dual-rail precharge-capable core for the cryptographic algorithm under consideration, which prevents the precharge process in rounds 3 to 14 in order to save electricity, while at the same time reducing the security level of the whole DES calculation does not deteriorate. In a preferred exemplary embodiment of the present invention, a control is thus provided which operates in the knowledge of the "endangered" and "endangered" rounds of a cryptographic calculation in order to only operate in the "endangered" "rounds to activate the energy-intensive pre-charge / pre-discharge mode.

Preferred embodiments of the present invention are explained in detail below with reference to the accompanying drawings. Show it:

1 shows a block diagram of a device according to the invention for calculating encrypted data from plain text data or vice versa;

Fig. 2 shows a preferred embodiment of the device shown in Fig. 1;

3a shows a block diagram of the sequence of the DES algorithm;

3b is a block diagram of the round function f of the DES algorithm of FIG. 3a;

4 is a block diagram of a general cascaded crypto-algorithm;

5 shows a basic circuit diagram of a dual-rail circuit with pre-charge / pre-discharge; and

Fig. 6 is a table illustrating the operation of pre-charge / pre-discharge.

1 shows a block diagram of a preferred embodiment of the present invention. In particular, FIG. 1 shows a device for calculating encrypted data from plain text data or vice versa, ie for calculating plain text data from encrypted data. For this purpose, a cryptographic algorithm is used, which in the exemplary embodiment shown in FIG. 1 has an initial stage 10, at least one intermediate stage 11 and an end stage 12. If the device shown in Fig. 1 is used for encryption, i.e. for generating encrypted output data from plain text input data, then the plain text input data are fed into the initial stage 10, or input data that is different from the original plain text input data without using a Key have been derived. Such derived plain text input data that can be fed into the initial stage 10 are, for example, the output data of the initial permutation 31 from FIG. 3a, which represents the DES algorithm.

At this point it should be noted that the keys for the stages of the algorithm may or may not be dependent on each other. In the case where the stages have laps of e.g. For example, the DES algorithm, the keys are dependent on one another, since they are all derived from a common “master key”. Alternatively, the keys can also be independent of one another for independent stages, such as, for example, in triple DES his.

Encrypted data are output from the initial stage 10, which have been encrypted using the key K _A provided to the initial stage 10. These output data of the initial stage 10 are then fed to the intermediate stage 11 so that the latter performs a re-encryption of the already encrypted output data of the initial stage 10, the intermediate stage 11, as shown in FIG. 1, having a key Kj _. used. Encrypted output data of the intermediate stage 11, which is now already using two keys K _A and Kj _. are encrypted, which are preferably different, are then in the final stage 12 (after processing in intermediate stages possibly still arranged between the intermediate stage 11 and the final stage 12), in order to be re-encrypted there using the key K _E , in order to finally encrypt the encrypted ones To receive output data or output data from which the encrypted output data are derived be tested. This derivation rule can again take place without the use of a cryptographic key and corresponds, for example, to the inverse permutation 38 of FIG. 3a using the DES algorithm as an example.

The processor device for performing the initial stage 10, the at least one intermediate stage 11 or the final stage 12 of the cryptographic algorithm is designed to carry out the initial stage 10 and / or the final stage 12 in a manner secured against a cryptographic attack, which is due to the double border is shown in Fig. 1. The processor device 13 is also designed to carry out the implementation of the intermediate stage 11 in a manner that is not secured against a cryptographic attack.

In this context, it should be pointed out that the implementation of the intermediate stage 11 does not have to be completely unsecured against a cryptographic attack, but only - compared to the implementation of the initial stage 10 and the final stage 12, it is unsecured, i.e. using fewer or no countermeasures against a cryptographic attack , If a high level of security is sought, this immediately leads to a high expenditure of chip area, energy and possibly time. If, on the other hand, less security is required for a calculation, this immediately leads to a lower expenditure of energy, possibly chip area and possibly time.

The device according to the invention shown in FIG. 1 therefore entails that, compared to the case in which the initial stage 10, the intermediate stage 11 and the final stage 12 are all carried out in a manner secured against a cryptographic attack Reduction of effort because at least when calculating the intermediate stage there is little or no additional effort for safety. According to the invention it is therefore assumed that an attacker can, if he so desires, carry out an attack on the intermediate stage, if this is possible at all, if it is thought that the output data and the input data are present somewhere on the chip and therefore are difficult to access. However, if an attacker succeeds in carrying out an attack on the intermediate stage, this does not help him further since he cannot make a reasonable hypothesis, since the input data into the intermediate stage is already encrypted using the key K _A in FIG. 1 have been. After the initial level 10 has been calculated in a secure manner, an attacker will not be able to find out the secret key K _{A of} the initial level.

In the preferred exemplary embodiment of the present invention shown in FIG. 1, no security compromises need to be made. With the same level of security compared to a fully secured embodiment of the algorithm, however, at least energy savings and, in certain implementations, time and chip area savings are achieved, as will be explained later.

In an alternative embodiment in which only a so-called forward attack is possible, which will depend in principle on the type of crypto-algorithm used, it is sufficient to secure only the initial stage 10 and the intermediate stage 11, which in this case could also be the final stage. to be carried out unsecured but with little effort. In this case, a cryptographic algorithm would have at least two stages, namely the initial stage 10 and the downstream intermediate stage 11, which is also the final stage. In this case, it is sufficient to secure only the initial stage 10. In an alternative embodiment of the present invention, only reverse attacks are possible. In this case, it is necessary to secure the final stage 12, but not the intermediate stage 11, which in this case could also be the initial stage. If such an algorithm had three stages, there would be its own initial stage, which would also not need to be secured due to the cryptographic attacks that only act from the exit to the entrance.

The device according to the invention thus ensures by securing either the first stage 10 or the last stage 12 or the first stage 10 and the last stage 12 that at least DPA attacks will fail, while at the same time by unsecured calculation of the intermediate stages due to the lack of hypothesis cannot be attacked, savings in chip area, energy or time can be achieved.

If the processor device shown in FIG. 1 is implemented in such a way that it has its own arithmetic unit for the initial stage 10, its own arithmetic unit for the intermediate stage 11 and its own arithmetic unit for the intermediate stage 12, in the preferred embodiment in which the The initial stage and the final stage are protected, they are designed at least in dual-rail and even better in dual-rail with precharge, while the arithmetic unit that implements intermediate stage 11 of the algorithm is implemented in simple single-rail technology without precharge. With regard to the intermediate stage 11, this leads to a chip area halving for the arithmetic unit for the intermediate stage 11 in comparison to a dual-rail implementation. Furthermore, compared to a full implementation with dual-rail and pre-charge, energy savings of around 75% are achieved. In addition, faster clocking is possible or adapted to the clock rates of the output stage and the

Input stage a slower clocking, which also with reduced energy consumption and simpler clock generator circuits.

In an alternative exemplary embodiment of the present invention, which is shown in FIG. 2, the iterative structure of an algorithm is used in such a way that a single arithmetic unit is provided in order, for example, to perform all round functions f (block 33 in FIG To calculate DES algorithm. Such an arithmetic unit is shown schematically at 20 in FIG. Since the arithmetic unit should reliably calculate both the initial stage 10 and the final stage 12 of FIG. 1, the arithmetic unit for the cryptographic function is implemented in dual-rail technology. It thus contains a user input 21a, which has a certain width of n bits, and a complementary input 21b, which has the same bit width n. The arithmetic logic unit 20 comprises a useful output 22a and a complementary output 22b, which have a bit width of m, where in the DES algorithm m can be n, although this is not essential for the present invention.

The processor device shown in FIG. 2 further comprises a preparation device 23 which carries out a pre-charge or pre-discharge by charging or discharging the inputs 21a, 21b and / or the outputs 22a, 22b of the arithmetic logic unit 20 to the same voltage level as already described the table shown in Fig. 6 has been explained. The processor device shown in FIG. 2 further comprises a controllable clock feed 24, which, like the preparation device 23, can be controlled by a control device 25. The processor device shown in FIG. 2 further comprises, in order to be suitable for the DES algorithm, a data input / output multiplexer, which is not shown in FIG. 2, and a key generator for deriving the round key K _x or if this function is carried out externally, at least one key feed, which is also not shown in FIG. 2. The data input / output Multiplexers and the key feed ensure that the arithmetic logic unit 20 is fed with the correct data in each round of the DES algorithm shown in FIG. 3a, and that the output data of the arithmetic logic unit at the outputs 22a and 22b are processed correctly or respectively XOR link etc. are subjected if the corresponding XOR link 34 is arranged externally by the arithmetic unit 20 for the cryptographic function.

The control device 25 is effective in order to control the preparation device 23 and the controllable clock feeder 24 in such a way that a pre-charge / pre-discharge operation takes place when the processor device 13 carries out the initial stage 10 of FIG. 1 of the cryptographic algorithm. in that the inputs and / or outputs of the arithmetic and logic unit 20 are prepared accordingly (by charging or discharging to the same value), and at the same time the controllable clock feed 24 to a useful cycle, a pre-charge cycle or pre-discharge cycle (P cycle ) so that the arithmetic unit 20 for cryptographic

Functions, which is already carried out in dual-rail technology, delivers an optimally safe performance profile.

Once the initial stage of the algorithm has been calculated, the control device 25 knows this when it controls the execution of the entire algorithm, or this is communicated to the control device 25 by a central controller. In this case, the arithmetic and logic unit 20 is switched from its secured calculation mode to the unsecured calculation mode by deactivating the preparation device 23

(OFF), and by addressing the controllable clock feed 24 in order to now not deliver a pre-charge clock. In unsecured mode, the arithmetic logic unit 20 receives only useful cycles from the controllable clock feed 24.

If the data throughput of the processor device is the same in the secure mode and in the unsecured mode, then the controllable clock feed 24 in the unsecured calculation mode only deliver half as many clock pulses, which leads to at least a halving of the energy consumption compared to the safe calculation mode for the initial stage and the final stage.

In order to keep the interventions in the dual-rail arithmetic unit 29 as low as possible, the complementary rail of the arithmetic unit 20 can continue to "run" in the unsecured calculation mode, although this is not absolutely necessary. An alternative can be used to further reduce energy consumption In the exemplary embodiment of the present invention, the control device 25 can also be designed to deactivate the second rail, ie the complementary rail, in the arithmetic logic unit 20, as is shown by a dashed control arrow in FIG. 2, so that this complementary rail in the unsecured calculation mode no power is consumed, which will lead to a further significant reduction in energy consumption.

Even if the complementary track runs in the unsecured calculation mode, but the precharge / pre-discharge cycle (preparation cycle) is dispensed with for reasons of energy saving, halving the number of clock edges leads to considerable energy savings, which for certain reasons still applies to certain versions can be further increased. A working cycle is usually generated on a chip using a so-called clock tree. A precise clock oscillator, which delivers an exact master clock at a certain operating frequency, is located at the root of a clock tree. Cycles with different clock rates can be derived from this master clock by division or multiplication. Since there is usually only a limited number of clock generators on a chip, in extreme cases only a single clock generator, and the clock or the various clocks have to be distributed to many locations on the chip, the clock tree also contains more There are more clock amplifiers that also consume a considerable amount of energy. If the clock tree is configured in such a way that the controllable clock feed 24 has a clock access for a “safe” clock, which has a useful clock pulse and a preparation clock pulse, and the controllable clock feed 24 is also designed to feed an “unsecured” work clock to the arithmetic unit, which is at half the clock frequency in comparison to the safe clock, energy savings are already achieved if, in the case of the unsecured mode, a switch is made from the "safe" clock to the "unsecured" clock. If, on the other hand, the "safe" clock is deactivated immediately when it is generated, that is to say as far up as possible in the clock tree, the clock amplifiers present in the clock tree for the safe clock will also be deactivated, so that they likewise do not involve any energy consumption.

At this point it should be noted that energy consumption is often not an essential aspect for applications connected to the power grid. However, this is completely different if the device according to the invention is to be used in the context of a contactless application, for example on a chip card which itself does not have its own power supply. If the chip card is brought near a terminal, it draws its power from an RF field generated by the terminal. In this case, if the chip card has less energy consumption, the terminal can be operated with a lower radiation power, that is to say it can be designed at low cost. For the chip card, this means that the antenna / rectifier arrangement can be made smaller by extracting an energy from the HF field and can therefore be made cheaper, which, with regard to chip cards, which typically reach very high numbers, leads to cost savings and thus price reductions can lead in the highly competitive market. In summary, the instructions for the control device 25 are listed in a box 26. In the secure mode for the initial stage 10 and / or the final stage 12, the control device 25 supplies the preparation device 23 with an ON signal and the controllable clock feeder 24 with a signal which indicates that a pre-charge / pre-discharge clock should be used. In the unsecured calculation mode, the control device 25 supplies the preparation device with an OFF signal and signals the controllable clock feeder 24 to work without a precharge clock.

In a preferred exemplary embodiment of the present invention, the arithmetic logic unit 20 is designed as a full-custom dual-rail pre-charge DES core, the DES core also comprising the preparation device 23 for the pre-charge / pre-discharge. In this preferred exemplary embodiment of the present invention, the control device 25 is designed as a finite state machine (FSM = FSM = finite state machine), which in the rounds 3 to 14 shown in FIG. 3a not only the corresponding control signals for controlling the data path and of the control part of the DES core, but additionally provides signals for switching off the precharge process, which are then used in the clock distribution tree to suppress the precharge process.

In the preferred embodiment, in which the logic circuit is implemented in hardware as a finite state machine, it is preferred due to the Feistel structure of the DES algorithm not only to carry out the first round (initial stage 1) in the secure mode, but also the second round (Initial stage 2) in secure mode, since in the first stage only half of the input data is actually encrypted, while in the second stage, the other half of the input data is also encrypted using a cryptographic key K ₂ . The same applies to the last round (final stage 2) and the penultimate round (final stage 1), which in the preferred one Embodiment of the present invention can also be carried out in secure mode in order to also be able to ward off a cryptographic reverse attack.

Depending on the actual circumstances, the concept according to the invention for calculating encrypted data from plain text data or for calculating plain text data from encrypted data can be implemented in hardware or in software. The implementation can take place on a digital storage medium, in particular a floppy disk or CD with electronically readable control signals, which can cooperate with a programmable computer system such that the method for calculating the corresponding data is carried out. In general, the invention thus also consists in a computer program product with program code stored on a machine-readable carrier for carrying out the method according to the invention when the computer program product runs on a computer. In other words, the invention is thus a computer program with a program code for carrying out the method when the computer program runs on a computer.

LIST OF REFERENCE NUMBERS

10 starting level

11 intermediate level

12 power amplifier

13 processor device 20 arithmetic unit

21a Service entrance

21b Complementary receipt

22a useful output

22b complementary output

23 Preparation device

23 controllable clock feed

25 control device

26 control instructions

30 DES input

31 initial permutation

32 Block halving

33 cryptographic function

34 XOR operation

35 XOR operation

36 XOR operation

37 Data classification

38 final permutation

39 DES edition

40 expansion surgery

41 XOR operation

42 Data arrangement

43 SBOX subscription 44 Data arrangement 45 Permutation

46 first algorithm

47 downstream second algorithm

48 downstream third algorithm

50 dual-rail circuit

51 clock generator

52 Preparation device Precharge state user data state Precharge state user data state

Claims

claims

1. Device for calculating encrypted data from plain text data or for calculating plain text data from encrypted data, using a cryptographic algorithm that has an initial stage (10), at least one downstream intermediate stage (11) or an end stage (12) and at least one Upstream intermediate stage (11), wherein in the initial stage (10) the plain text data or the encrypted data or input data derived from the plain text data or from the encrypted data can be fed, final output data from which the encrypted output data or the plain text output data can be derived, or the encrypted data or decrypted data itself can be output, output data of the initial stage being able to be fed into the at least one intermediate stage, or output data of the intermediate stage upstream of the final stage being able to be fed into the final stage following features:

a processor device (13) for performing the initial stage (10), the at least one intermediate stage (11) or the final stage (12) of the cryptographic algorithm, the processor device being designed to include the initial stage (10) and / or the final stage (12 ) in a manner secured against a cryptographic attack, and in order to carry out the at least one intermediate stage (11) in a manner unsecured against a cryptographic attack.

2. Apparatus according to claim 1, wherein the processor device (13) is designed to carry out a current, a power and / or a time profile in a secured manner when carrying out the initial stage (10) and / or the final stage (12) to have less meaningful information about the data to be processed than a current, power or time pro fil that arises in the unsecured manner when the at least one intermediate stage (11) is carried out.

3. Device according to claim 1 or 2, wherein the cryptographic attack is selected from the following group: simple performance analysis, simple current analysis, simple time analysis, differential performance analysis, differential current analysis or differential time analysis.

4. Apparatus according to claim 1, 2 or 3, wherein the processor device (13) is designed to have a higher energy consumption, a higher chip area consumption and / or a higher time consumption when performing a calculation in the secured manner, compared to egg - Carrying out a calculation in the unsecured way.

5. Device according to one of the preceding claims, wherein the processor device (13) for performing the initial stage (10) and / or the final stage (12) is designed in dual-rail technology and for performing the at least one intermediate stage in single-rail -Technology is trained.

6. Device according to one of the preceding claims,

in which the processor device (13) is designed to carry out the initial stage and / or the final stage using a preparation clock between two data clocks, a pre-charge or a pre-discharge operation being executable in the preparation clock, and

in which the processor device (13) is designed to carry out the at least one intermediate stage (11) in order not to use a preparation clock between two data clocks.

7. Device according to one of claims 1 to 4, in which the initial stage (10), the final stage (13) and the at least one intermediate stage (11) have an identical round function (33).

8. The device according to claim 7, wherein according to the cryptographic algorithm, a secret round key is provided for each round.

9. The device according to claim 7 or 8,

in which the processor device (13) has an arithmetic unit (20) for performing the round function, a controllable clock feeder (24) for supplying a clock for the arithmetic unit (20), a preparation device (23) and a control device (25) for controlling the preparation device ( 23) and the controllable clock feed (24),

the arithmetic unit (20) being designed in dual-rail technology,

wherein the control device (25) is designed so that when the arithmetic unit (20) executes the initial stage (10) and / or the final stage (12) of the cryptographic algorithm, the arithmetic unit is operated in the secured manner, the clock feed (24 ) is controlled in such a way that it provides a preparation cycle before a Νutzakt, and that the preparation device (23) in the preparation cycle causes a pre-charge state or a pre-discharge state of the arithmetic unit (20), and

then, when the arithmetic unit (20) performs the at least one intermediate stage (11), to operate the arithmetic unit in the unsecured manner, the clock feed (24) being controlled so that it does not provide a preparation clock, so that no pre-charge state or Pre-discharge state of the calculator (20) is effected.

10. The apparatus of claim 9, wherein the controllable clock supply has a clock generator and at least one clock amplifier, wherein when the arithmetic unit performs the at least one intermediate stage (11), the control device (25) is effective around the at least one clock amplifier to deactivate.

11. Device according to one of claims 7 to 10, wherein the cryptographic algorithm is designed to supply input data not processed by the round function to the round function in a first round, and to supply further input data to the round function in a second round not processed by the round function , and

in which the control device (25) is designed to operate the arithmetic unit for the first round and the second round in the secured manner.

12. Device according to one of claims 7 to 11, wherein the cryptographic algorithm is designed to generate output data from a penultimate round that are no longer subjected to any further round function, and to generate further output data from a last round that no further Round function to be subjected more

wherein the control device (25) is designed to operate the arithmetic unit for the penultimate and the last round in the secured manner.

13. The device according to one of claims 1 to 12,

in which the cryptographic algorithm has an initialization stage (31) before the initial stage in order to generate the initial input data from the plain text data, and in which the processor device (13) is designed to carry out the initialization stage in the unsecured manner.

14. The device according to one of claims 1 to 13,

in which the cryptographic algorithm has a final stage (38) after the final stage, the processor device (13) being designed to carry out the final stage in which no cryptographic key is used in an unsecured manner.

15. The device according to one of claims 1 to 14,

in which the cryptographic algorithm is the DES algorithm with 16 rounds, and

in which the processor device (13) is designed to carry out the first and the second round and / or the 15th and the 16th round in the secured manner, wherein at least one of the laps 3 to 14 can be carried out in the unsecured manner.

16. Device according to one of the preceding ^' claims, in which the processor device (13) is designed to use a higher clock rate when carrying out the intermediate stage in the unsecured manner than when calculating in the secured manner.

17. Method for calculating encrypted data from

Plain text data or for calculating plain text data from encrypted data, using a cryptographic algorithm which has an initial stage (10), at least one downstream intermediate stage (11) or an end stage (12) and at least one upstream intermediate stage (11), with the initial stage (10) the plain text data or the encrypted data or of the plain text data or of the encrypted data derived input data can be fed, from the output stage final output data from which the encrypted output data or the plain text output data can be derived, or the encrypted data or decrypted data itself can be output, with output data of the initial stage in the at least one intermediate stage are feedable, or wherein output data of the intermediate stage upstream of the output stage can be fed into the output stage, with the following steps:

Performing (13) the initial stage (10) and / or the final stage (12) in a manner secured against a cryptographic attack, and performing the at least one intermediate stage (11) in a manner unsecured against a cryptographic attack.

18. A computer program with a program code for carrying out the method for calculating encrypted data from plain text data or plain text data from encrypted data according to claim 17, if the computer program runs on a computer.